CISA is urging organizations to harden their internet-accessible Fortinet devices in response to a large-scale credential theft campaign that likely impacts over 86,000 firewalls and VPNs.
Referred to as FortiBleed, the campaign was flagged earlier this week. SOCRadar initially warned of over 30,000 compromised Fortinet devices potentially exposing enterprise networks to hacking, and has since updated that figure to 86,000.
“Discovered in June 2026, the operation has produced a verified database of over 86,644 confirmed working credentials across 194 countries, all collected from internet-facing Fortinet infrastructure,” the company says.
The hackers have compiled a database of usernames and passwords, tested using automated scripts. Some credentials were likely compromised in previous incidents, but never rotated.
Security researcher Kevin Beaumont, together with Hudson Rock, worked with some of the impacted organizations and verified that the logins are valid and fairly recent.
